Re: [cgiwrap-users] Is there no relief?
Brought to you by:
nneul
From: Chung Y. L. <ga...@ui...> - 2003-02-13 20:25:03
|
On Wed, 12 Feb 2003 19:51:55 -0500 (EST) "Peter M. Jansson" <pe...@cl...> wrote: > I have a similar problem in that scripts that generate > pages embed links, and the CGI.pm module is returning > those links as /cgi-bin/cgiwrap/... It seems as if some > environment variable is not being hidden (SCRIPT_NAME?), > but I don't know how to avoid the exposure, so I just make > sure I protect both possible paths. I'd like to know how > to avoid the problem, if anyone has a suggestion. Hi Peter, Yep, SCRIPT_NAME is probably the culprit. It's set to the physical path. I don't know of any way to rewrite that variable using mod_rewrite and having it stick. For example, you could use the RewriteRule flag 'E': RewriteRule /(.+)/(.+\.cgi)$ /cgi-bin/cgiwrap/$1/$2 [PT,E=SCRIPT_NAME:bogus_path] But SCRIPT_NAME gets overwritten later on in Apache's processing. As an alternative, you could do something like this early in your CGI script (example in Perl): $ENV{ 'SCRIPT_NAME' } = $ENV{ 'SCRIPT_URL' }; Then as CGI.pm generates your dynamic web page, it will be using the original URL as it was entered into the browser's URL/Location box. Chung |